Topic starter
14/07/2026 5:23 pm
TL;DR: A Critical Windows DHCP tampering flaw, CVE-2026-45602, carries a 9.1 CVSS score and a 48 percent EPSS exploitation probability, according to Senserva, making pre-KEV patching the practical priority for exposed Windows Server and Windows 10 1809 estates. The issue underscores how network control-plane weaknesses can turn routine patching into identity and routing governance work, not just vulnerability hygiene.
Editorial analysis by NHI Mgmt Group, based on content published by Senserva: “CVE-2026-45602: Windows DHCP Flaw, Patch First”.
By the numbers:
- CVE-2026-45602 carries a CVSS base score of 9.1.
- FIRST.org's EPSS puts CVE-2026-45602 at 48 percent exploit probability.
Key questions
Q: What breaks when a Windows DHCP tampering flaw is left unpatched?
A: An attacker who can tamper with DHCP responses can influence how clients receive network configuration, which can redirect traffic, distort DNS resolution, or disrupt service reachability.
Q: Why should teams prioritise pre-KEV vulnerabilities over waiting for confirmed exploitation?
A: Pre-KEV prioritisation matters because high exploitability often appears before public confirmation of abuse.
Q: How can security teams tell whether a patch programme is actually working?
A: A patch programme is working when installation success is confirmed across the full estate, exploited vulnerabilities are cleared first, and exceptions are measured rather than hidden.
Practitioner guidance
- Prioritise pre-KEV patching for high-likelihood flaws Move CVEs with high EPSS and critical impact ahead of the regular patch queue, even before they appear in KEV, so attacker interest does not outrun remediation.
- Verify DHCP-related fixes across every Windows ring Confirm that all affected Windows Server 2019 and Windows 10 1809 systems received the cumulative update through Windows Update, WSUS, Intune, or catalog deployment.
- Add DHCP integrity checks to drift management Baseline expected network configuration and continuously compare live state against it, especially on servers that provide DHCP services or sit in path for critical routing.
Bottom line: The article shows how a network service vulnerability can become a trust problem when it affects DHCP, not just a routine patching issue.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
14/07/2026 5:27 pm
Patch timing has become a governance decision, not a maintenance decision. When exploit probability is already high, waiting for KEV confirmation simply hands initiative to attackers. The organisation is no longer deciding whether a vulnerability exists, but whether it will be remediated before abuse becomes visible. Practitioners should treat pre-KEV prioritisation as a core risk-management discipline.
A few things that frame the scale:
- The median time to fully patch a vulnerability in CISA's Known Exploited Vulnerabilities catalog rose to 43 days, according to Verizon's 2026 Data Breach Investigations Report.
A question worth separating out:
Q: What is the difference between CVSS severity and EPSS exploit probability?
A: CVSS describes how severe the impact could be if a vulnerability is exploited, while EPSS estimates how likely exploitation is in the near term. Practitioners need both because severity alone does not tell them which flaws are most likely to be targeted first.
👉 Read our full editorial: Windows DHCP tampering risk shows why patch timing matters